Back to OSINT guides

theHarvester

The must-have OSINT reconnaissance tool to collect emails, names, subdomains and public data

40+
Data sources
Open Source
Python 3.6+
100%
Passive

What is theHarvester?

theHarvester is an OSINT reconnaissance tool written in Python that collects public information from more than 40 different sources. Created by Christian Martorella and maintained by the EdgeSecurity community, it has become a standard for the passive reconnaissance phase.

The tool excels at the automated collection of email addresses, people's names, subdomains, IP addresses and URLs. Unlike active scanning tools, theHarvester only uses public sources, making reconnaissance fully passive and undetectable.

Key points

  • 40+ sources - Search engines, social networks, DNS, APIs
  • Passive reconnaissance - No direct interaction with the target
  • Multi-format export - JSON and XML for easy integration
  • Open source - Code available on GitHub, constantly updated

Core capabilities

Discover the features that make theHarvester essential for OSINT reconnaissance

Sources
40+

Email collection

Automatic extraction of email addresses from multiple public sources

  • Bing, Brave, Yahoo
  • Hunter, RocketReach
  • Patterns validation
  • Deduplication
Accuracy
95%+

Subdomain discovery

Full enumeration of subdomains and related SSL certificates

  • DNS enumeration
  • Certificate transparency
  • DNSDumpster
  • Shodan integration
Detection
Nulle

Passive reconnaissance

OSINT investigation with no direct interaction with the target

  • Passive scanning
  • No direct contact
  • Stealth mode
  • Public data only
APIs
15+

API integrations

Native connection to the main threat intelligence platforms

  • Shodan API
  • VirusTotal API
  • SecurityTrails
  • Hunter.io
Formats
4

Export multi-format

Report generation in several formats for analysis and reporting

  • JSON export
  • XML format
  • SQLite database
  • Result replay
Python
3.6+

Automatisation

CLI and Python scripts to plug into your reconnaissance workflows

  • CLI interface
  • Python library
  • Batch processing
  • Scheduled scans

Data sources

More than 40 built-in sources for thorough reconnaissance

Search engines

Brave
Search engine

Emails, subdomains

Bing
Search engine

Emails, domains

Yahoo
Search engine

Emails, contacts

Baidu
Search engine

Asia-Pacific data

DuckDuckGo
Search engine

Private search

Social & professional networks

Hunter.io
Email finder

Emails, address format (API key)

RocketReach
Contacts

Employees, job titles (API key)

GitHub code
Dev platform

Domain mentions in code (API key)

Tomba
Email finder

Professional emails (API key)

DNS & Certificats

DNSDumpster
DNS recon

Subdomains, DNS records

crt.sh
Certificate logs

SSL/TLS certificates

CertSpotter
Certificate logs

Subdomains via certificates

VirusTotal
Security

DNS resolutions, malware

Intelligence & APIs

Shodan
IoT search

Devices, ports, banners

SecurityTrails
DNS intel

Historical DNS data

Hunter.io
Email finder

Email verification

URLscan
URL analysis

Website scanning

Installation

Install theHarvester in minutes

1

Install with pip (recommended)

sudo apt install theharvester

Package maintained in the Kali Linux repositories

2

Install from GitHub

git clone https://github.com/laramies/theHarvester.git cd theHarvester uv sync uv run theHarvester -h

To get the development version with the latest features

3

Check the installation

theHarvester -h

Shows the help and confirms the installation succeeded

OSINT use cases

Practical scenarios for using theHarvester in investigations

Company reconnaissance

Gather information about a target organization

1

Identify the target's main domain

2

Run a multi-source search (Bing, Brave, crt.sh)

3

Collect employee email addresses

4

Map the organizational structure

5

Identify subdomains and infrastructure

6

Analyze email patterns (@company.com)

7

Produce an initial reconnaissance report

Subdomain enumeration

Discover all of an organization's subdomains

1

Use crt.sh for SSL certificates

2

Query DNSDumpster for mapping

3

Cross-check with VirusTotal and Shodan

4

Identify live subdomains

5

Detect exposed services

6

Analyze DNS configurations

7

Document the attack surface

Social media monitoring

Monitor an organization's social presence

1

Cross-check the names found with the company website and public profiles

2

Identify key employees and their roles

3

Analyze Twitter posts and mentions

4

Map the professional network

5

Detect leaked sensitive information

6

Track staff movements

7

Build an organizational profile

Command examples

Practical commands for different reconnaissance scenarios

Basic commands

theHarvester -d example.com -l 500 -b bing,duckduckgo

Search engines, limited to 500 results

BasicSearch engines
theHarvester -d example.com -b all

Search across all available sources

All sourcesComprehensive
theHarvester -d example.com -b crtsh,certspotter -l 200

Certificate Transparency sources, 200 results max

CT logsSubdomains

DNS & domain search

theHarvester -d example.com -b crtsh,dnsdumpster

Subdomain enumeration via certificates and DNS

DNSSubdomains
theHarvester -d example.com -b virustotal

VirusTotal search (key set in api-keys.yaml)

VirusTotalAPI
theHarvester -d example.com -b crtsh -s

-s queries Shodan for discovered hosts (key in api-keys.yaml)

ShodanIoT

Export & Automation

theHarvester -d example.com -b all -f report

-f saves results to report.json and report.xml

ExportJSON
theHarvester -d example.com -b all -n

-n performs reverse DNS on the ranges found

DNSReverse
theHarvester -d example.com -b all -v -r -f full_scan

-v verifies hosts via DNS, -r resolves subdomains, JSON + XML export

VerboseXML

Best practices

Essential recommendations for responsible and effective use

Do

  • Combine several sources
    Use -b all or combine Bing, Brave, crt.sh and API-key sources for more results
  • Export the results
    Save to JSON/XML for later analysis and documentation
  • Use API keys
    Configure Shodan, VirusTotal, SecurityTrails for richer results
  • Validate emails
    Check the patterns and validity of the addresses found
  • Document your research
    Keep track of sources and collection dates
  • Use a VPN/proxy
    Protect your IP during intensive searches

Avoid

  • Flooding requests
    Avoid overly frequent searches that can get your IP blocked
  • Ignoring API limits
    Respect the quotas of Shodan, VirusTotal and other services
  • Relying on a single source
    Always cross-check information across several sources
  • Storing sensitive data carelessly
    Encrypt your exports and protect the information you collect
  • Skipping verification
    Not every result is valid: filter out false positives
  • Using it without authorization
    Make sure you are authorized to perform reconnaissance

Complete practical example

A complete investigation workflow on an organization

Investigation : Example Corp

1

Initial reconnaissance - Emails

theHarvester -d example.com -l 500 -b bing,duckduckgo,yahoo -f emails

Collect email addresses from several sources

2

Subdomain enumeration

theHarvester -d example.com -b crtsh,certspotter,dnsdumpster -f subdomains

Discover infrastructure through certificates and DNS

3

Intelligence with APIs

theHarvester -d example.com -b virustotal,securityTrails -s -f intel

Enrichment with Shodan and VirusTotal data

4

Full report

theHarvester -d example.com -b all -v -f complete_report

Final JSON and XML export with all the data

Resources and documentation

Useful links to go further

Official GitHub repository

Source code, documentation and latest updates

View the code

Wiki & Documentation

Complete guide, tutorials and usage examples

Read the docs

Ready to start reconnaissance?

Explore other powerful OSINT tools and practice with our real-world case studies

See case studiesOther OSINT guides
CyberXTEL
100% Free

Ready to put it into practice?

CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.

Discover CyberXTEL